nerdexam
(ISC)2

CGRC · Question #463

Mark works as a Network Administrator for NetTech Inc. He wants users to access only those resources that are required for them. Which of the following access control models will he use? Response:

The correct answer is B. Role-Based Access Control. Role-Based Access Control (RBAC) is the appropriate model to ensure users only access resources necessary for their specific job functions.

Selection and Approval of Framework, Security, and Privacy Controls

Question

Mark works as a Network Administrator for NetTech Inc. He wants users to access only those resources that are required for them. Which of the following access control models will he use? Response:

Options

  • AMandatory Access Control
  • BRole-Based Access Control
  • CDiscretionary Access Control
  • DPolicy Access Control

How the community answered

(29 responses)
  • A
    3% (1)
  • B
    86% (25)
  • C
    7% (2)
  • D
    3% (1)

Why each option

Role-Based Access Control (RBAC) is the appropriate model to ensure users only access resources necessary for their specific job functions.

AMandatory Access Control

Mandatory Access Control (MAC) is a highly restrictive model based on security labels and clearances, which is not typically used for common organizational least privilege enforcement.

BRole-Based Access ControlCorrect

Role-Based Access Control (RBAC) assigns permissions based on an individual's role within an organization, ensuring users only have access to resources required for their specific job functions.

CDiscretionary Access Control

Discretionary Access Control (DAC) allows resource owners to grant or deny access, which can lead to inconsistent security policies and does not easily enforce organization-wide least privilege.

DPolicy Access Control

Policy Access Control is a general concept for governing access, not a specific access control model like RBAC, MAC, or DAC.

Concept tested: Access control models - Role-Based Access Control

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-192.pdf

Topics

#Access Control Models#Role-Based Access Control (RBAC)#Least Privilege#Network Security

Community Discussion

No community discussion yet for this question.

Full CGRC Practice